[plug] Help with SU

[Daniel Pearson (Flashware Solutions)]

No worries :-D

Is it worth doing a check for a rootkit? Have any other files done odd 
things?

Phillip Bennett wrote:
> Sorry Daniel.  I saw Mark at the top and addressed that to the wrong person.
>
> Apologies,
> Phil.
>  
>
> -----Original Message-----
> From: plug-bounces at plug.org.au [mailto:plug-bounces at plug.org.au] On Behalf
> Of Daniel Pearson (Flashware Solutions)
> Sent: 30 March 2007 16:24
> To: plug at plug.org.au
> Subject: Re: [plug] Help with SU
>
> Mark O'Shea wrote:
>   
>> On Thu, 2007-03-29 at 14:46 +0100, Phillip Bennett wrote:
>>   
>>     
>>> However, now I can't su to root.  It gives me a 'wrong password' error.
>>> Fortunately, I can still use 'sudo su -' to get root.
>>>     
>>>       
>>   
>>     
>>> Can anyone shed any light on why this would happen?  Or at least 
>>> where to look?  I've checked the PAM files and the nsswitch.conf.  
>>> There's nothing in any of the logs (messages, secure etc..)  I'm 
>>> completely stumped.  I thought I knew how logging in worked, but I 
>>> guess I've missed something fairly important.
>>>     
>>>       
>> Curious.  There's *nothing* in the logs for the auth facility (check 
>> where it's going in the config for your syslogd, whichever one you 
>> use) for su? Not even for the successful ones executed under sudo?
>>
>> It sounds like you can authenticate okay for everything apart from su 
>> using local password files now that your not going through kerberos to 
>> authenticate to ad.  This does suggest pam config, maybe things are 
>> out of order.  What does the pam config for su actually say?
>>
>>   
>>     
> What about sudo passwd root ?
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
>
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.plug.org.au/pipermail/plug/attachments/20070330/5bbd6e2c/attachment.html>